2023-08-05 第五周

已于 2023-10-18 09:33:14 修改
阅读量126 收藏
点赞数
文章标签： 运维 java 数据库
于 2023-10-18 09:23:11 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/weixin_48636572/article/details/133898621
版权

一、SUDO,PAM配置规范说明

SUDO

在suduers配置文件下修改，或者是在suduers.d的文件夹下修改
-r–r----- 1 root root 4463 Aug 5 10:37 sudoers
drwxr-x—. 2 root root 6 Apr 20 2022 sudoers.d

## Next comes the main part: which users can run what software on 
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:                 #suduers文件下的配置修改
##
##             user        MACHINE =   （runas）    COMMANDS            
##       #执行权限的用户名  登入的主机 =（代表的用户） 要执行的命令
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere 
root    ALL=(ALL)       ALL
ma      ALL=(root)      /usr/bin/mount /dev/cdrom /mnt/,/usr/bin/umount /mnt
ma      ALL=            /bin/cat /var/log/vmware-network*

PAM

type control module-path arguments
type：指模块类型，即功能
control ：PAM库该如何处理与该服务相关的PAM模块的成功或失败情况，一个关健词实现
module-path： 用来指明本模块对应的程序文件的路径名
Arguments： 用来传递给该模块的参数

[11:04:07 root@rocky8 ~]#ls /lib64/security/*.so     #模块文件
/lib64/security/pam_access.so                /lib64/security/pam_group.so       /lib64/security/pam_pwhistory.so       /lib64/security/pam_timestamp.so
/lib64/security/pam_cap.so                   /lib64/security/pam_issue.so       /lib64/security/pam_pwquality.so       /lib64/security/pam_tty_audit.so
/lib64/security/pam_chroot.so                /lib64/security/pam_keyinit.so     /lib64/security/pam_rhosts.so          /lib64/security/pam_umask.so
/lib64/security/pam_console.so               /lib64/security/pam_lastlog.so     /lib64/security/pam_rootok.so          /lib64/security/pam_unix_acct.so
/lib64/security/pam_cracklib.so              /lib64/security/pam_limits.so      /lib64/security/pam_securetty.so       /lib64/security/pam_unix_auth.so
/lib64/security/pam_debug.so                 /lib64/security/pam_listfile.so    /lib64/security/pam_selinux_permit.so  /lib64/security/pam_unix_passwd.so
/lib64/security/pam_deny.so                  /lib64/security/pam_localuser.so   /lib64/security/pam_selinux.so         /lib64/security/pam_unix_session.so
/lib64/security/pam_echo.so                  /lib64/security/pam_loginuid.so    /lib64/security/pam_sepermit.so        /lib64/security/pam_unix.so
/lib64/security/pam_env.so                   /lib64/security/pam_mail.so        /lib64/security/pam_shells.so          /lib64/security/pam_userdb.so
/lib64/security/pam_exec.so                  /lib64/security/pam_mkhomedir.so   /lib64/security/pam_sss_gss.so         /lib64/security/pam_usertype.so
/lib64/security/pam_faildelay.so             /lib64/security/pam_motd.so        /lib64/security/pam_sss.so             /lib64/security/pam_warn.so
/lib64/security/pam_faillock.so              /lib64/security/pam_namespace.so   /lib64/security/pam_stress.so          /lib64/security/pam_wheel.so
/lib64/security/pam_filter.so                /lib64/security/pam_nologin.so     /lib64/security/pam_succeed_if.so      /lib64/security/pam_xauth.so
/lib64/security/pam_ftp.so                   /lib64/security/pam_permit.so      /lib64/security/pam_systemd.so
/lib64/security/pam_google_authenticator.so  /lib64/security/pam_postgresok.so  /lib64/security/pam_time.so
[11:04:23 root@rocky8 ~]#ls /etc/pam.d/         #系统程序调用的专有模块配置文件
atd   chsh         crond             login  passwd         polkit-1   remote   runuser-l       smtp          sshd              su    sudo-i  system-auth   vlock
chfn  config-util  fingerprint-auth  other  password-auth  postlogin  runuser  smartcard-auth  smtp.postfix  sssd-shadowutils  sudo  su-l    systemd-user  vmtoolsd
[11:09:53 root@rocky8 ~]#ls /etc/security/      #模块的专有配置文件
access.conf  console.apps      console.perms    faillock.conf  limits.conf  namespace.conf  namespace.init  pam_env.conf    pwquality.conf.d  time.conf
chroot.conf  console.handlers  console.perms.d  group.conf     limits.d     namespace.d     opasswd         pwquality.conf  sepermit.conf
[11:11:51 root@rocky8 ~]#vim /etc/pam.d/sshd   #配置模块详细内容
#%PAM-1.0
#type      control         module-path        arguments            模块类型     模块控制   模块路径   参数
auth       substack     password-auth          
auth       include      postlogin
account    required     pam_sepermit.so
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    optional     pam_motd.so
session    include      password-auth
session    include      postlogin

二、chrony搭建私有ntp服务

[11:41:42 root@rocky8 ~]#yum -y install chrony                    #先安装chrony服务
Last metadata expiration check: 2:25:24 ago on Sat 05 Aug 2023 09:16:32 AM CST.
Package chrony-4.1-1.el8.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
#服务器端
[11:41:57 root@rocky8 ~]#vim /etc/chrony.conf                      #设置服务器的同步功能
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#pool 2.pool.ntp.org iburst
server ntp.aliyun.com iburst
server time1-5.cloud.tencent.com iburst
server ntp1-7.aliyun.com iburst

# Allow NTP client access from local network.
#allow 192.168.0.0/16
allow 10.0.0.0/24                                                    #允许与服务器同步的网段

# Serve time even if not synchronized to a time source.
local stratum 10                                                     #在互联网无法连接时，仍然能为客户端提供时间同步服务

[11:50:11 root@rocky8 ~]#systemctl restart chronyd                   #重启服务


#客户端
[11:51:17 root@rocky8 ~]#vim /etc/chrony.conf 
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#pool 2.pool.ntp.org iburst                                      
server 10.0.0.8 iburst                                                #客户机以服务器地址为时间同步的目标地址

[11:56:10 root@rocky8 ~]#systemctl restart chronyd                    #重启服务

[11:56:27 root@rocky8 ~]#chronyc sources -v

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current best, '+' = combined, '-' = not combined,
| /             'x' = may be in error, '~' = too variable, '?' = unusable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* 10.0.0.8                      3   6    17     6   -955ns[  -43us] +/-   30ms                   #^*表示同步成功

三、说明CDN原理

本质上就是提供就近服务器的域名和转发
1.给浏览器输入一个域名，浏览器第一次发现本地没有DNS缓存，则向网站的DNS服务器请求。
2.网站的DNS域名解析设置了CNAME，请求指向了CDN网络中的只能DNS负载均衡系统。
3.只能DNS负载均衡系统解析域名，把用户响应速度最快的IP节点返回给用户。
4.用户向该IP节点（CDN服务器）发出请求
5.由于是第一次访问，CDN服务器会通过Cache内部专用DNS解析得到此域名的原web站点IP，向原站点服务器发起请求，并在CDN服务器上缓存内容。
6.请求结果发给用户。

四、搭建智能DNS，实现不同地域客户端解析到不同主机

#每个机器配置好IP
[13:20:11 root@rocky8 ~]#ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:92:cf:ce brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.8/24 brd 10.0.0.255 scope global noprefixroute eth0
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:92:cf:d8 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.8/24 brd 192.168.10.255 scope global noprefixroute eth1

[13:06:07 root@centos7 ~]#ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:e9:e6:bc brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.7/24 brd 10.0.0.255 scope global noprefixroute eth0

[13:19:44 root@rocky8 ~]#ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:7f:6a:1b brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.7/24 brd 192.168.10.255 scope global noprefixroute eth0

#在DNS服务器端配置
[13:23:43 root@rocky8 ~]#vim /etc/named.conf 
acl beijingnet {
       10.0.0.0/24;
};
acl shanghainet {
       192.168.10.0/24;
}; 
acl  othernet {
       any;
};

 //      listen-on port 53 { 127.0.0.1; };                                               #注释
        listen-on-v6 port 53 { ::1; };  
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        secroots-file   "/var/named/data/named.secroots";
        recursing-file  "/var/named/data/named.recursing";
//      allow-query     { localhost; };                                                   #注释

view beijingview {           
           match-clients { beijingnet;};
           include "/etc/named.rfc1912.zones.bj";
};

view shanghaiview {
           match-clients { shanghainet;};
           include "/etc/named.rfc1912.zones.sh";
};

view otherview {
           match-clients { othernet;};
           include "/etc/named.rfc1912.zones.other";
};

#有view视图的情况下不能有zone所以把下方的znoe挪到对应的/etc/named.rfc1912.zones数据文件下。

#配置对应的区域文件
[13:46:01 root@rocky8 ~]#vim /etc/named.rfc1912.zones.bj         
zone "." IN {
        type hint;
        file "named.ca";
};
zone "mazhuobo.com" IN {
        type master;
        file "mazhuobo.com.zone.bj";
};

[13:49:18 root@rocky8 ~]#vim /etc/named.rfc1912.zones.sh
zone "." IN {
        type hint;
        file "named.ca";
};      
zone "mazhuobo.com" IN {
        type master; 
        file "mazhuobo.com.zone.sh";
};

[13:52:24 root@rocky8 ~]#vim /etc/named.rfc1912.zones.other 
zone "." IN {
        type hint;
        file "named.ca";
};
zone "mazhuobo.com" IN {
        type master;
        file "mazhuobo.com.zone.other";
};

[13:53:52 root@rocky8 ~]#ll /etc/named.rfc1912.zones.*
-rw-r----- 1 root root 1177 Aug  5 13:49 /etc/named.rfc1912.zones.bj
-rw-r----- 1 root root 1186 Aug  5 13:53 /etc/named.rfc1912.zones.other
-rw-r----- 1 root root 1176 Aug  5 13:52 /etc/named.rfc1912.zones.sh
                                                             #更改他们的所有组 chgrp named /etc/named.rfc1912.zones.*
[13:54:46 root@rocky8 ~]#ll /etc/named.rfc1912.zones.*
-rw-r----- 1 root named 1177 Aug  5 13:49 /etc/named.rfc1912.zones.bj
-rw-r----- 1 root named 1186 Aug  5 13:53 /etc/named.rfc1912.zones.other
-rw-r----- 1 root named 1176 Aug  5 13:52 /etc/named.rfc1912.zones.sh
#配置区域数据库文件
[13:54:48 root@rocky8 ~]#vim /var/named/mazhuobo.com.zone.bj
$TTL 1D
@   IN SOA master admin.mazhuobo.com. (
                    2023080510 ; serial
                   1D ; refresh
                   1H ; retry
                   1W ; expire
                   3H )   ; minimum
           NS   master
master     A    10.0.0.8
websrv     A    10.0.0.7                          
www       CNAME websrv
[14:00:57 root@rocky8 ~]#vim /var/named/mazhuobo.com.zone.sh
$TTL 1D
@   IN SOA master admin.mazhuobo.com. ( 2023080510  ; serial 1D ; refresh 1H ; retry1W ; expire3H )   ; minimum
           NS   master
master     A    10.0.0.8
websrv     A    192.168.10.7
www       CNAME websrv

[14:08:18 root@rocky8 ~]#vim /var/named/mazhuobo.com.zone.other
$TTL 1D
@   IN SOA master admin.mazhuobo.com. (
                    2023080510  ; serial
                   1D ; refresh
                   1H ; retry
                   1W ; expire
                   3H )   ; minimum
           NS   master
master     A    10.0.0.8
websrv     A    127.0.0.1
www       CNAME websrv

[14:07:17 root@rocky8 ~]#ll /var/named/mazhuobo.com.zone.*
-rw-r--r-- 1 root root 340 Aug  5 13:59 /var/named/mazhuobo.com.zone.bj
-rw-r--r-- 1 root root 338 Aug  5 14:06 /var/named/mazhuobo.com.zone.other
-rw-r--r-- 1 root root 212 Aug  5 14:05 /var/named/mazhuobo.com.zone.sh
                                                               #更改他们的所有组chgrp named /var/named/mazhuobo.com.zone.*
[14:09:35 root@rocky8 ~]#ll /var/named/mazhuobo.com.zone.*
-rw-r--r-- 1 root named 340 Aug  5 13:59 /var/named/mazhuobo.com.zone.bj
-rw-r--r-- 1 root named 340 Aug  5 14:08 /var/named/mazhuobo.com.zone.other
-rw-r--r-- 1 root named 212 Aug  5 14:05 /var/named/mazhuobo.com.zone.sh

#重启服务器
systemctl restart named

#web服务器上安装http 
[14:51:25 root@rocky8 ~]#yum install httpd -y
#分别写入数据
echo www.mazhuobo.com in * > /var/www/html/index.html
#重启服务
systemctl restart httpd

#测试确保网关正确
# 10.0.0.8
[15:03:35 root@rocky8 ~]#cat /etc/resolv.conf 
# Generated by NetworkManager
search mazhuobo
nameserver 192.168.10.2
[15:03:37 root@rocky8 ~]#curl www.mazhuobo.com
www.mazhuobo.com in Other

#10.0.0.28
[15:00:47 root@rocky8 ~]#cat /etc/resolv.conf;
# Generated by NetworkManager
search mazhuobo
nameserver 10.0.0.8
[15:00:51 root@rocky8 ~]#curl www.mazhuobo.com
www.mazhuobo.com in Beijing

#192.168.10.6
[15:01:27 root@rocky8 ~]#cat /etc/resolv.conf 
# Generated by NetworkManager
search mazhuobo
nameserver 192.168.10.8
[15:01:46 root@rocky8 ~]#curl www.mazhuobo.com
www.mazhuobo.com in Shanghai

五、解释DNS解析流程

迭代查询：查询目标地址先访问DNS代理解析服务器，代理服务器也没有地址去访问>>.根服务器,根没有去访问>>.com域名服务器，.com域名服务器没有去访问>>二级域名服务器>>依次迭代>>返回域名
递归查询：访问DNS代理解析查找到缓存有地址直接返回

DNS原理

六、.iptables 5表5链解释

5链

INPUT,OUTPUT,FORWARD,PREROUTING,POSTROUTING

三种报文流向

流入本机：PREROUTING --> INPUT–>用户空间进程
流出本机：用户空间进程 -->OUTPUT–> POSTROUTING
转发：PREROUTING --> FORWARD --> POSTROUTING

5链
5表5链的搭配

5表

五个表table：filter、nat、mangle、raw、security

filter：过滤规则表，根据预定义的规则过滤符合条件的数据包,默认表
nat：network address translation 地址转换规则表
mangle：修改数据标记位规则表
raw：关闭启用的连接跟踪机制，加快封包穿越防火墙速度
security：用于强制访问控制（MAC）网络规则，由Linux安全模块（如SELinux）实现
###优先级从高到底排序
security -->raw–>mangle–>nat–>filter

七、iptables/firewalld/nftable 实现主机防火墙。5000-6000端口仅192.168.0.0/24网段内的主机访间

iptables

[09:44:45 root@rocky8 ~]#iptables -A INPUT ! -s 192.168.0.0/24 -p tcp --dport 5000:6000 -j REJECT

firewalld

[10:15:36 root@rocky8 ~]#firewall-cmd  --add-port=5000-6000/tcp
success
[10:15:49 root@rocky8 ~]#firewall-cmd --list-port
5000-6000/tcp
[10:16:37 root@rocky8 ~]#firewall-cmd  --add-source=192.168.0.0/24 
success
[10:16:42 root@rocky8 ~]#firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 192.168.0.0/24
  services: cockpit dhcpv6-client ssh
  ports: 5000-6000/tcp
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

[10:22:43 root@rocky8 ~]#firewall-cmd  --add-rich-rule='rule family=ipv4 source address=192.168.0.0/24 port port=5000-6000 protocol=tcp accept'
success

nftable

#先创建一个表
[10:33:47 root@rocky8 ~]#nft add table inet test_table           
#在表中创建一个链
[10:36:40 root@rocky8 ~]#nft add chain inet test_table test_filter_input_chain {type filter hook input priority 0 \; } 
#添加规则
[10:46:50 root@rocky8 ~]#nft add rule inet test_table test_filter_input_chain  ip saddr 10.0.0.1 accept
[10:53:16 root@rocky8 ~]#nft add rule inet test_table test_filter_input_chain  ip saddr 192.168.0.0/24 tcp dport  5000-6000 accept
[10:53:24 root@rocky8 ~]#nft add rule inet test_table test_filter_input_chain  ip saddr 0.0.0.0/24 tcp dport  5000-6000 reject
#查看规则
[10:55:39 root@rocky8 ~]#nft list ruleset
table inet test_table {
	chain test_filter_input_chain {
		type filter hook input priority filter; policy accept;
		ip saddr 10.0.0.1 accept
		ip saddr 192.168.0.0/24 tcp dport 5000-6000 accept
		ip saddr 0.0.0.0/24 tcp dport 5000-6000 reject
	}
}

八、mysql的各发行版有哪些 ?

关系型数据库和非关系型数据库

关系型数据库常见的有
MySQL: MySQL, MariaDB, Percona Server
PostgreSQL: 简称为pgsql，EnterpriseDB
Oracle
MSSQL Server
DB2

非关系型数据库常见的
redis

mysql有MySQL Enterprise Edition（企业版）、MySQL Cluster CGE（集群）、MySQL Community（社区版）

MySQL 的三大主要分支
MySQL
Mariadb
Percona Server

版本的演变
MySQL：5.1 --> 5.5 --> 5.6 --> 5.7 -->8.0
MariaDB：5.1 -->5.5 -->10.0–> 10.1 --> 10.2 --> 10.3 --> 10.4 --> 10.5

九、mysql索引的作用

索引是帮助 MySQL 高效获取数据的数据结构（有序）。在数据之外，数据库系统还维护着满足特定查找算法的数据结构，这些数据结构以某种方式引用（指向）数据，这样就可以在这些数据结构上实现高级查询算法，这种数据结构就是索引。

优缺点：

优点：

  • 提高数据检索效率，降低数据库的IO成本
  • 通过索引列对数据进行排序，降低数据排序的成本，降低CPU的消耗

缺点：

  • 索引列也是要占用空间的
  • 索引大大提高了查询效率，但降低了更新的速度，比如 INSERT、UPDATE、DELETE

十、mysql btree索引的原理

B-tree
就是每一个节点上都有指针和数据，通过判断插入key的大小，来确定一个数据插入的位置，比如一个5阶B-tree，那就是每个节点最多有4key，5个指针
B-tree
B-tree的动画演示 B-Tree Visualization (usfca.edu)

B+tree
就是只有叶子节点才有数据，而且所有叶子节点形成一个单向链表
B+tree
B+tree的动画演示 B+ Tree Visualization (usfca.edu)

十一、mysql安全加固?

mysql的安全加固脚本主要针对于MySQL5.6之前的版本

运行mysql_secure_installation脚本
MySQL5.6之前
设置数据库管理员root口令
禁止root远程登录
删除anonymous用户帐号
删除test数据库

在5.6版本之后可以不用执行安全加固脚本

4.18
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值